Application Commands in Multi-Tenant Mode

Application REST commands are those that define or modify application schemas, update data, query data, or perform other application-specific commands supported by the managing storage service. When Doradus is operating in multi-tenant mode, all such commands must identify the target tenant by appending ?tenant={tenant} to the URI. For example, the following commands are directed to the tenant named HelloKitty:

Examples:

POST /_applications?tenant=HelloKitty // create a new application

POST /foo/bar?tenant=HelloKitty // add data to application foo

GET /_tasks?tenant=HelloKitty // list tasks for all applications

GET /_olapp?tenant=HelloKitty // display the OLAP browser

If no ?tenant parameter is provided, the command is directed to the default tenant and no credentials are required. (Note that access to the default tenant may be disabled if the option disable_default_keyspace is set to true.) When a REST command uses other URI query parameters, the tenant parameter can be given anywhere in the query string. URI query parameters are separated by the ampersand (&). The following commands are equivalent, sending a query to the application foo in the HelloKitty tenant:

GET /foo/bar/_query?q=*&tenant=HelloKitty

GET /foo/bar/_query?tenant=HelloKitty&q=*

Tenant-specific application commands must be accompanied with valid credentials for that tenant. Credentials are passed using a basic authorization (basic auth) header Authorization. Example:

Authorization: Basic xxx

Where xxx is the tenant user ID and password, separated by a colon, and base64-encoded. For example, if the user ID and password are Katniss:Everdeen, the header would look like this:

Authorization: Basic S2F0bmlzczpFdmVyZGVlbgo=

When Doradus receives this header, the base64 value is decoded and validated against the given tenant. Note that curl supports basic authentication by adding the “-u” parameter. Example:

curl -u Katniss:Everdeen http://localhost:1123/HelloKitty/...

If the tenant user ID or password is incorrect for the identified tenant, the REST command returns a 401 Unauthorized response.

Note that super user credentials can be used to access any tenant, hence they must be kept secured.